Cool to see our work here. I'm Thai, and I run Calif. Happy to answer any questions.
We'll publish the technical details of these hacks over the coming weeks. Writing these articles takes time, and we've been busy with a PHP thing [1].
In the meantime, check out The Great Glyph Grift [2] for a glimpse of what can go wrong when iOS parses PDFs.
Just in case you wonder, we've disclosed most of the bugs in these exploit chains to Apple and will disclose the rest. So far in 2026, we've reported close to 100 bugs to Apple. We don't accept Apple bounties, and we're not being paid for this work. We don't sell bugs or exploits, and we have no sponsors funding this research.
We do this because it's fun, intellectually challenging, and we want to help make the iPhone safer. We also have a business to run, so we do need some marketing points.
Hey Thai- How much of the at Calif is managing agents to explore ideas? Are ideas coming from agents themselves or still human generated, and has that changed since y'all started the company?
On the cost side- How expensive is it to develop each of these demos w.r.t. inference cost? Are y'all purely using OAI/A\ cyber models or are there OSS models being used too?
We disclosed most of the bugs used in these chains to Apple, and are going to disclose the rest, if not already.
>Just as a reminder for some folks here: During their WeWorm research in July–September 2026, Calif didn't stop at proving RCE to Tencent—they spent an extra week using AI to build a fully functional, self-propagating zero-click worm across three live phones, triggering temporary account bans from Tencent during testing.
Not sure what exactly your point is. The WeWorm demo was done in a controlled environment.
Also we do this for free. We don't charge neither Tencent nor Apple. We don't even take their bounties. Why can't we have some fun?
If you're so upset about how we do it, my suggestion is go find your own bugs.
You literally just said your company released an exploit demo before disclosing some of these vulnerabilities to the vendor.
As for your suggestion, I was an infosec researcher, I worked for 3 years with vendors to help them patch before I can even tweet anything about my research. I even flew to their HQ to assist in patching when needed. After Covid I transitioned to a development role, and now I'm on the other end, handling security reports from researchers.
Based on this dual point of view, let me tell you that for a security engineer in Apple that will learn from your video about vuln your company did not even disclose yet, this karma harvesting is as far from "coordinated disclosure" as possible. Their managers will be fuming, and the stress they will be in given the media frenzy will be off the charts.
"our" is a stretch. Not only because you're giving an algorithm personhood, but because you didn't do any of the real work. So you could instead say that it's "nice to randomly encounter what I prompted an instance of [brand of artificially intelligent dowsing rod] to do". There's your chance to claim ownership; you can plainly state that you're the person who pressed the button.
Thank you. If correct, that is helpful. I only checked my own copy and as far as I can tell, the feature is disabled. It may well be that I disabled it, I don't remember. Seems like the kind of thing I would disable if I noticed it but iTerm2 has so many features and so many settings that I have no idea whether I ever noticed it before this.
I note that the documentation says this:
> Shell Integration
> iTerm2 may be integrated with the unix shell so that [blah blah blah]
> How To Enable Shell Integration
> [blah blah blah]
And that does not make it sound as if it's enabled by default. I really don't know. I only started using iTerm2 about three or four weeks ago.
We'll publish the technical details of these hacks over the coming weeks. Writing these articles takes time, and we've been busy with a PHP thing [1].
In the meantime, check out The Great Glyph Grift [2] for a glimpse of what can go wrong when iOS parses PDFs.
Just in case you wonder, we've disclosed most of the bugs in these exploit chains to Apple and will disclose the rest. So far in 2026, we've reported close to 100 bugs to Apple. We don't accept Apple bounties, and we're not being paid for this work. We don't sell bugs or exploits, and we have no sponsors funding this research.
We do this because it's fun, intellectually challenging, and we want to help make the iPhone safer. We also have a business to run, so we do need some marketing points.
[1] https://calif.io/php2shell
[2] https://calif.io/research/the-great-glyph-grift